MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48
SHA3-384 hash: 6e9686b3bc47ca85241573cc0392858953c15da3e78d969131c327a3dc0463fd358df87068b7ac7e92836059e20ee54b
SHA1 hash: ec778acec7bfe578f6d13556765e5ed5ba0a405b
MD5 hash: 1e1f169ac3fc87ad55252f38cad083bb
humanhash: uranus-king-stream-jig
File name:doc_391200004532000450.scr
Download: download sample
Signature Formbook
Create hunting rule
File size:921'232 bytes
First seen:2021-05-06 13:07:09 UTC
Last seen:2021-05-06 14:09:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a4e462a199bd933bfcc2e6a6ed1e5792 (2 x Formbook, 1 x BitRAT)
ssdeep 12288:B85p/Fufy1iu51lf2ChJrScwHWZe7EimMU8/r3V2JKOdKU/Oy/wUL:B8rdbV1J2qV4pEaLqKOdKUD/w2
Threatray 5'086 similar samples on MalwareBazaar
TLSH D9158D61B2C24433D0AF5E74AC3BB7745C36FE821AE8104627F83D589F797613A3A586
Reporter lowmal3
Tags:FormBook

Intelligence

File Origin
# of uploads :
3
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/151619/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Launching a process
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/714068
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Execution from Suspicious Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 405971 Sample: doc_391200004532000450.scr Startdate: 06/05/2021 Architecture: WINDOWS Score: 100 37 www.thespotifygrowthguide.com 2->37 39 www.sassyfurbaby.com 2->39 41 2 other IPs or domains 2->41 69 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 6 other signatures 2->75 10 doc_391200004532000450.exe 1 19 2->10         started        signatures3 process4 dnsIp5 61 onedrive.live.com 10->61 63 fayzja.dm.files.1drv.com 10->63 65 dm-files.fe.1drv.com 10->65 35 C:\Users\Public\Hmrblz\Hmrblz.exe, PE32 10->35 dropped 97 Writes to foreign memory regions 10->97 99 Allocates memory in foreign processes 10->99 101 Creates a thread in another existing process (thread injection) 10->101 103 Injects a PE file into a foreign processes 10->103 15 secinit.exe 10->15         started        file6 signatures7 process8 signatures9 105 Modifies the context of a thread in another process (thread injection) 15->105 107 Maps a DLL or memory area into another process 15->107 109 Sample uses process hollowing technique 15->109 111 2 other signatures 15->111 18 explorer.exe 4 15->18 injected process10 dnsIp11 43 austinenglishtutor.com 162.211.86.152, 49757, 80 PRIVATESYSTEMSUS United States 18->43 45 www.maximized.systems 192.195.77.64, 49753, 80 ONEANDONE-ASBrauerstrasse48DE United States 18->45 47 7 other IPs or domains 18->47 77 System process connects to network (likely due to code injection or exploit) 18->77 22 Hmrblz.exe 16 18->22         started        26 Hmrblz.exe 16 18->26         started        28 raserver.exe 18->28         started        signatures12 process13 dnsIp14 49 onedrive.live.com 22->49 51 fayzja.dm.files.1drv.com 22->51 53 dm-files.fe.1drv.com 22->53 79 Multi AV Scanner detection for dropped file 22->79 81 Machine Learning detection for dropped file 22->81 83 Writes to foreign memory regions 22->83 30 secinit.exe 22->30         started        55 onedrive.live.com 26->55 57 fayzja.dm.files.1drv.com 26->57 59 dm-files.fe.1drv.com 26->59 85 Allocates memory in foreign processes 26->85 87 Creates a thread in another existing process (thread injection) 26->87 89 Injects a PE file into a foreign processes 26->89 32 mshta.exe 26->32         started        91 Modifies the context of a thread in another process (thread injection) 28->91 93 Maps a DLL or memory area into another process 28->93 95 Tries to detect virtualization through RDTSC time measurements 28->95 signatures15 process16 signatures17 67 Tries to detect virtualization through RDTSC time measurements 32->67
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-05-06 13:08:13 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nrw5iwushv7ln6q7cfffutba7kzhxqb6iss4rs4ge7kd3kj57zea._file
Verdict:
malicious
Similar samples:
1de5c6b986a6401ba0490ccce78e8bf125d9604d07c4ad87a856a588f0aba6cb
Formbook
4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
Formbook
48d7ee8524b6c594ee30967ffa0b0c651ff0ea54162aa142e13fcd9c9a577125
Formbook
5acfc6aa1ccbdc619df590b1b8092e0c1687558b7f01a7015a20d2a146e60a7f
Formbook
63b94415ccf2fabff3be3a811ded9a5306d68ac197adc07d7c2be3b313e8a665
Formbook
6657aeabd5ded830361aad9112749d785fc0fbe46121daeb7acb23cd841274ed
Formbook
8855c73a66320b1d62c22f7af62feb301d13e4b68f4edfba64bf47473ad58c4a
Formbook
959b34597496ad489c8f8371ddc89fce086376f9fc966b97d2bdfa8967ca5e8e
Formbook
c0565af2331df2f4c2b1dd0d96200c21dadb9add0a3e1debaba3b241c38bb3da
Formbook
e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c
Formbook
+ 5'076 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader persistence rat
Link:
https://tria.ge/reports/210506-qj2t25h7l2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.austinenglishtutor.com/ipio/
Unpacked files
SH256 hash:
c6295b0bd000c0a8adf3d7d30d0c247ce225c316bb36372c8b801cb574c162e8
MD5 hash:
a73977dc46f611d9848cd16387034abe
SHA1 hash:
8131047bb48e7759b55199d7f8d9e49af7cc7503
Link:
https://www.unpac.me/results/954c0c68-d2f6-452d-bb08-ac77b1f59296/
SH256 hash:
8f63001a412f92b1e28e17cf0ca84b5d4fa126a661cdae11c5221b7344c26999
MD5 hash:
77fbc4c0b74cf1b87fa3804f3c4c0ff1
SHA1 hash:
721f7b2c9db79c8a34b8ad43f103b22df632d2dc
Link:
https://www.unpac.me/results/954c0c68-d2f6-452d-bb08-ac77b1f59296/
SH256 hash:
6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48
MD5 hash:
1e1f169ac3fc87ad55252f38cad083bb
SHA1 hash:
ec778acec7bfe578f6d13556765e5ed5ba0a405b
Link:
https://www.unpac.me/results/954c0c68-d2f6-452d-bb08-ac77b1f59296/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6c6dd45a923d7eb6fa1f114a5a4c20fab27bc03e44a5c8cb8627d43da93dfe48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_56f008e69a7c4c3feb389c66eaf58259
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:MALWARE_Win_DLAgent07
Create hunting rule
Author:ditekSHen
Description:Detects delf downloader agent

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/151619/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-06 14:08:14 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
3) [F0002.002] Collection::Polling
5) [C0021] Cryptography Micro-objective::Generate Pseudo-random Sequence
6) [C0026.002] Data Micro-objective::XOR::Encode Data
8) [C0051] File System Micro-objective::Read File
9) [C0052] File System Micro-objective::Writes File
10) [C0007] Memory Micro-objective::Allocate Memory
11) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
12) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
13) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
14) [C0038] Process Micro-objective::Create Thread
15) [C0041] Process Micro-objective::Set Thread Local Storage Value
16) [C0018] Process Micro-objective::Terminate Process